Custom Assessment and Remediation Release 2.5.2 API
June 25, 2025
Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.
CAR API Versioning Support
We have scheduled a few CAR version 1 APIs for End-of-Support (EOS) and End-of-Life (EOL) from this release. We recommend migrating to the latest versions of these APIs to ensure continued compatibility, support, and access to the latest features and security enhancements.
Impacted APIs
The following table lists the APIs, along with their respective EOS and EOL timeline details:
API | EOS Timeline | EOL Timeline | Latest Endpoint |
---|---|---|---|
Search List of Blocked Commands by LanguageId API
Endpoint: /sm/v1/block-commands/{id} |
December 2025 - June 2026 | June 2026 | /sm/v1/block-commands/search |
Create Script API
Endpoint: /sm/v1/script |
December 2025 - June 2026 | June 2026 | /sm/v5/script |
Update Scripts API
Endpoint: /sm/v1/script/{scriptid} |
December 2025 - June 2026 | June 2026 | /sm/v4/script/{scriptid} |
For more information, refer to CAR API User Guide.
To support your understanding, definitions of key terms such as End-of-Support (EOS) and End-of-life (EOL) are given below, explaining the lifecycle of each endpoint.
End-of-Support (EOS)End-of-Support (EOS)
End-of-Support for an API version signifies the point at which Qualys will no longer actively maintain or enhance that specific version. While the API may continue to function, it will not receive new features, performance improvements, or security updates. This phase is intended to provide a grace period for API consumers to migrate to newer versions.
Implications of End-of-Support
- No New Features: The API version will not receive any further functional enhancements or new capabilities.
- Limited Bug Fixes: Critical security vulnerabilities may be addressed on a case-by-case basis, but general bug fixes for non-critical issues will stop.
- No Performance Improvements: Optimization efforts focus solely on newer API versions.
- Reduced Support Channels: Technical support for issues related to this specific API version may become limited, and users are strongly recommended to upgrade.
- No Guarantees of Reliability: While the API may remain operational, Qualys offers no guarantees regarding its continued reliability beyond the EOS date.
End-of-Life (EOL)End-of-Life (EOL)
End-of-Life for an API version is the final stage where the API version is officially retired and will be completely decommissioned. After the EOL date, the API will no longer be available, and any calls to it will result in errors. This marks the complete discontinuation of service for that specific API version.
Implications of End-of-Life
- API Decommissioning: The API endpoint for this version is shut down and will no longer accept requests.
- Complete Service Stoppage: All functionalities provided by this API version will cease to exist.
- Error Responses: Any attempt to call the EOL API results in HTTP error codes, such as 404 Not Found or 410 Gone, or similar error messages.
- No Support: All forms of support, documentation, and resources related to this API version will be discontinued.
Enhancement in Blocked Command APIs
You can now update or delete blocked commands by sending their unique command ID(s) in the API request. This unique identifier is introduced as a new input parameter (commandId
) in the following APIs:
API Versioning in Blocked Command APIs
We have enhanced the Update Blocked Commands and Delete Blocked Commands APIs with the new version 2 (v2) endpoints to enable you to test the new API version while maintaining the production environment with the old API version.
We recommend migrating to the latest versions of these APIs to ensure continued compatibility, support, and access to the latest features and security enhancements.
Update Blocked Commands API: Introduced a new parameter
New or Updated API | Updated |
API Endpoint (Old Version) | sm/v1/block-commands/update |
API Endpoint (New Version) | sm/v2/block-commands/update |
Method | POST |
DTD or XSD changes | Not Applicable |
With this new version, you can update a blocked command using the commandId
parameter.
Sample: Update the blocked commandSample: Update the blocked command
API Request
curl -X POST
'<qualys_base_url>/sm/v2/block-commands/update'
-header 'Content-Type: application/json'
-header 'Authorization: Bearer {{authToken}}'
-data '{
"languageId": 201,
"commandId": 206,
"commands": "cmd1,cmd2,cmd3,cmd4",
"user": {
"id": "9321f0b3-5372-4107-817c-d5647de6da11",
"name": "string",
"userName": "string"
}
}'
Response
{
"body": "Commands Updated Successfully"
}
Delete Blocked Commands API: Introduced a new parameter
New or Updated API | Updated |
API Endpoint (Old Version) | sm/v1/block-commands/delete |
API Endpoint (New Version) | sm/v2/block-commands/delete |
Method | POST |
DTD or XSD changes | Not Applicable |
With this new version, you can delete a blocked command using the commandIds
parameter.
Sample: Delete the blocked commandSample: Delete the blocked command
API Request
curl -X POST
'<qualys_base_url>/sm/v2/block-commands/delete'
-header 'Content-Type: application/json'
-header 'Authorization: Bearer {{authToken}}'
-data '{
"commandIds": [2,3],
"user": {
"id": "9321x0x3-5372-4107-817x-x5647xx6Xx11",
"name": "string",
"userName": "string"
}
}'
Response
{
"body": "Commands Deleted Successfully"
}
Support for Multiple Detection Conditions in Custom QID Scripts
We have extended the support for multiple detection conditions to the Scripts APIs. You can now:
- Configure primary and secondary detection conditions to detect custom QIDs.
- Configure the QID as Detected or Not-detected for each condition individually.
For more information, refer to the Enhanced Custom QID Detection based on Script Output section in the CAR 2.5.2 Release Notes.
The following APIs are impacted due to this enhancement:
Create Scripts API: Introduced multiple detection logic support
New or Updated API | Updated |
API Endpoint | /sm/v5/script |
Method | POST |
DTD or XSD changes | Not Applicable |
You can use this API to create a custom QID script with two detection conditions based on the script output.
Sample: Create a custom QID detection scriptSample: Create a custom QID detection script
API Request
curl -X POST
'<qualys_base_url>/sm/v5/script'
--header 'Accept: application/vnd.qualys.car.api.v5.0+json'
--header 'Authorization: Bearer <authToken>'
--header 'Content-Type: application/json'
--data-raw
'{
"categoryId": 605,
"content": "bHMgLWx0cg==",
"description": "sample description",
"platform": "WINDOWS",
"severity": "3",
"threshold":300,
"thresholdTimeUnit": "SECOND",
"title": "Sample title",
"typeId": 2,
"languageId": 204,
"scriptApprovalUserConsent": true,
"hasParameters": true,
"customQid": {
"type": "Detection QID",
"severity": "4",
"qds": "75",
"vulnerabilityType": "Information_Gathered",
"cveIds": "CVE-2023-3452",
"detectionLogic": "Use Script",
"detectionRegex": [
{
"regex": [
"java 9"
],
"cardinality": "CONTAINS",
"status": "detected"
},
{
"regex": [
"java 11"
],
"cardinality": "CONTAINS",
"status": "not-detected"
}
],
"params": [
{
"key": "string",
"value": "string"
}
]
}'
Response
{
"errorCode": "0",
"message": "Script created successfully",
"body": {
"id": 213673
}
}
Update Scripts API: Introduced multiple detection logic support
New or Updated API | Updated |
API Endpoint | /sm/v4/script/{ScriptId} |
Method | PATCH |
DTD or XSD changes | Not Applicable |
You can use this API to update the detection conditions defined under the detectionRegex
object.
Sample: Update the custom QID detection conditionSample: Update the custom QID detection condition
API Request
curl -X PATCH
'<qualys_base_url>/sm/v4/script/{ScriptId}'
--header 'Accept: application/vnd.qualys.car.api.v4.0+json'
--header 'Authorization: Bearer <authToken>'
--header 'Content-Type: application/json'
--data-raw
'{
"categoryId": 605,
"content": "bHMgLWx0cg==",
"description": "sample description",
"platform": "WINDOWS",
"severity": "3",
"threshold":300,
"thresholdTimeUnit": "SECOND",
"title": "Sample title",
"typeId": 2,
"languageId": 204,
"scriptApprovalUserConsent": true,
"hasParameters": true,
"customQid": {
"type": "Detection QID",
"severity": "4",
"qds": "75",
"vulnerabilityType": "Information_Gathered",
"cveIds": "CVE-2023-3452",
"detectionLogic": "Use Script",
"detectionRegex": [
{
"regex": [
"java 9"
],
"cardinality": "CONTAINS",
"status": "detected"
},
{
"regex": [
"python"
],
"cardinality": "CONTAINS",
"status": "not-detected"
}
],
"params": [
{
"key": "string",
"value": "string"
}
]
}'
Response
{
"id": 213673,
"message": "Updated Successfully."
}